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A STUDY OF THE LONGEVITY 
AND OPERATIONAL RELIABILITY 
OF GODDARD SPACECRAFT: 
|9t>0-1980 


INTRODUCTION 

Aside from being a matter of general historic ini rest, the analysis of the performance of space- 
craft in orbit provides a means to: 1) quantify progress. 2 ) identify problem areas, 3) aid in evalu- 
ating the effectiveness of flight assurance and reliability management practices, and 4) establish 
empirical relationships which can be used in forecasting future mission results and in planning 
management strategies. As longer and longer missions are planned, and more management options 
become available (or even mandated as in the case of the new STS payload classification scheme), 
these objectives become more important. 

- Spacecraft performance is defined by both how well and how long the spacecraft performs its 
assigned mission. Previous analyses of Goddard data have concentrated on how well missions have 
performed in terms of the frequency, criticality, and distribution of anomalies during flight. An 
update of this material is currently in preparation. The focus of the current study is spacecraft 
longevity and their consequent operational reliability. Data was compiled for 104 orbital missions 
having launch dates spanning the period from 1 9t>0 to 1 980. Omitting irrelevant missions such as 
small piggybacks and missions for which Goddard did not have primary mission-success responsi- 
bility, such as the later International programs, this is a virtually complete roster of Goddard 
orbital missions. A brief description of these and other NASA missions may be found in “Satellite 
Handbook: A Record of NASA Space Missions 1958-1980", edited by A. Rosenthal. NASA/GSFC, 
1981. 

The analysis, which consists of a historical review of trends over the entire period and a more 
detailed examination of the more recent missions, is primarily statistical, but specific programs and 
problems are discussed as an aid in interpreting the data and placing it in perspective. 


I 



SOURCES, DEFINITIONS, AND LIMITATIONS OF THE DATA 

The goal of the data collection effort was to compile information on the design life and useful 
lifetime of as many relevant Goddard satellites as possible. Data from project-related documents 
was utilized where available, but in some cases it was necessary to rely on secondary sources. 
“Useful lifetime” is defined as the period of time during which the spacecraft satisfied the objec- 
tives of its mission. This generally corresponds to its total active life, but in some cases spacecraft 
have been continued in service after serious functional losses in order to obtain secondary data. 
This situation, which applies primarily to some of the very early missions, led to occasional dis- 
agreement between sources on the useful lifetime of certain missions. These were resolved insofar 
as possible by consulting performance data, but there may be some remaining inconsistences. 

Spacecraft are generally not continued in service until functional capability is totally lost. The 
causes of mission termination may be classified as follows: 


Loss of Functional Capability: • 


Unexpected Failure 
Wearout 

Depletion of Consumables 


Reentry: 


• Planned (Mission Requirement) 

• Unplanned (Incorrect Orbit) 


Deactivation: 


• Excessive degradation 

• Mission completed 

• Funding Withdrawn 

• Obsolescence 

• Replacement 


Since many spacecraft are terminated while still viable to a greater or lesser extent, it would be 
desirable to establish uniform reliability criteria, such as percentage degradation of performance. 



and base the useful lifetime (which might then be termed “reliable lifetime”) on those criteria. 

This has been done in cases where the spacecraft population is more homogeneous, such as the 
Canadian Telesat communications satellite program, where mission success requires that 12 of 14 
available channels be operable, but is not easily accomplished for programs as varied in scope as 
Goddards. This is particularly true of the science missions. 

Alternately, those missions which are terminated prior to failure might be considered as truncated 
data, that is as a “life test” which ended before failure occurred. This, however, would imply that 
no degradation had occurred during the life of the mission. In practice, it was found that most 
spacecraft had seriously degraded or had used up a major fraction of their consumable supplies by 
the tune they were removed from service or reentered and therefore had completed a major portion 
jf their potential lifetime. Hence, useful lifetime as a “de facto” measure of successful performance 
appears to be a good working hypothesis. To provide a convenient reference source and permit 
the interested reader to construct his own analyses, the entire data base including overall active life 
and data sources is shown in Appendix A. Pertinent launch vehicle data in shown in Appendix B. 

GENERAL HISTORY AND TRENDS 

Due to limitations in the available technology and in knowledge of the hazards of the space environ- 
ment, in the early days of the space age orbital missions usually terminated by catastrophic failure 
or depletion of non-renewable supplies after a few weeks or months in orbit. Since these missions 
were essentially engineering feasibility studies, however, with limited scientific objectives, these 
lifetimes were generally more than adequate to achieve the desired objectives. Although same 
missions were assigned goals of as long as one year as early as 1961, through 1 964 many included 
timers designed to turn off the spacecraft after a year in orbit in order to avoid Glutting the RF 
channels with obsolete transmissions. These timers often di J not work, however, and the missions 
were usually continued beyond the one year period if useful data were still being obtained. 

Through 1965, only one Goddard mission, Syncom I, which failed to return any data from space, 
was officially declared unsuccessful. 
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By the mid-sixties, spacecraft were beginning to achieve lifetimes of a year or more on a fairly 
regular basis, while at the same time significant advances had been made in space technology. 
The feasibility of achieving very long orbital lifetimes was demonstrated as early as 1966 by the 
Goddaid mission Application Technology Satellite I (ATS-I), and by the JPL project Pioneer VI, 
both of which are still in limited service after 1 5 years in space. It was also during this period that 
the ambitious orbiting observatory programs Orbiting Astronomical Observatory (OAO) and Orbit 
ing Geophysical Observatory (OGO), conceived in the early sixties, came to fruition. These were 
the first Goddard programs to exceed half a ton in weight (OAO actually weighed almost 2 tons) 
and also incorporated one of the major innovations of the era, three-axis attitude control stabili- 
zation, which enabled spacecraft to be pointed precisely at a specific object in space. While ihe 
first OAO suffered a power failure at orbital injection, thereby becoming the second and final 
Goddard mission to fail to return any useful data from space, two follow-on missions were highly 
successful. The second of these, nicknamed Copernicus, was only recently deactivated after eight 
and a half years of excellent service. 

The first two OGO’s experienced difficulties which prevented their achieving three-axis stabiliza- 
tion, as did a later mission, ATS-V. All three of these missions served long useful lives (ATS-V is 
still active) despite this problem, but were officially classified as unsuccessful. No subsequent 
Goddard mission has been classified unsuccessful by the Agency. 

Throughout the sixties, design goals continued to be set at 6 months or one year for the most 
part, but spacecraft began to exceed these goals by increasingly wide margins. 

By 1970, this led to an embarrassment of riches, as more data began to be received than could be 
processed within planned budget allocations. Technological obsolescence also became a factor in 
mission termination as second-generation spacecraft were placed into service. 

At this point, the success of the program combined with increasing pressure on NASA budgets led 
to more flexible management policies wherein costs and the relative importance of each phase of 
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the flight assurance program were measured against project criticality and acceptable risk levels. 
Certain missions began to be designated as low cost/high risk, where some of the elements generally 
considered important to reliability were sacrificed in the interest of reducing costs. This approach, 
for example, typically calls for the elimination of block redundancy. Where no clear-cut designa- 
tion of cost-risk trade off was imposed, each mission was nevertheless implicitly controlled in this 
regard by strict budget accountability, with the more critical missions being assigned the more 
generous budgets. This trend continued through the seventies, and has now been formalized for 
Shuttle payload applications in a NASA management instruction which designates four classes of 
payloads discriminated by four leve's of flight assurance requirements. 

Another trend in the seventies resulting trom the developing maturity of space technology was an 
increasing emphasis on applications satellites. Applications programs usually consist of a series of 
, ‘ essentially identical spacecraft intended to provide a service such as communications or meteor- 

ological observations for a given number of years. There is a tendency on these programs to main- 
tain older, partially degraded satellites in a standby mode as backups to the newer active satellites. 
Since many studies have shown that failure rates for inactive spacecraft are extremely low, this 
tends to extend the useful lives of these satellites. 

GROWTH AND DISTRIBUTION OF USEFUL LIFETIMES 

These trends are illustrated graphically in Figures 1 and 2. Figure 1 illustrates the growth in median 
lifetime of satellites launched in each calendar year through 1974, with later data being indeter- 
minate since most of the more recent missions are still active. Note that the growth rate is not only 
persistent but surprisingly linear, and closely adheres to the trend line determined by regression 
analysis, particularly through the first decade. The somewhat greater scatter past 1970 may, in 
part, be caused by the increasing degree to which mission lifetime was becoming a matter of man- 
agement options. The trend is described by the equation: 

ML *0.1 +0.361 (Y- 1960) (1) 

Where ML is the median life and Y is the calendar year. 
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Figure 1. Annual Median Growth Rate Through 1975 


Table 1 presents the specific data for each year, including the mean values and maximum useful 
lifetimes achieved. 


Table 1 


LAUNCH YEAR 

NO. OF'S/C 

USEFUL LIFETIME 



MEDIAN 

MEAN 

MAX. 

1960 

3 

.21 

.33 

.63 

1961 

3 

.40 

.44 

.61 

1962 

8 

.88 

1.03 

2.53 

1963 

5 

.82 

2.24 

4.33 

1964 

7 

1.59 

1.67 

5.23 

1965 

5 

1.92 

2.01 

3.48 

1966 

9 

2.36 

3.72+ 

ACTIVE 

1967 

9 

2.24 

3.32+ 

ACTIVE 

1968 

5 

4.20 

3.63 

4.95 

1969 

7 

3.51 

4.27+ 

ACTIVE 

1970 

4 

2.70 

3.99 

10.00 

1971 

3 

3.17 

3.20 

3.56 

1972 

6 

5.84 

5.26+ 

ACTIVE 

1973 

4 

4.38 

4.82+ 

ACTIVE 

1974 

3 

5.17 

5.43+ 

ACTIVE 


Figure 2 illustrates the distribution of useful lifetimes achieved in the 5 year intervals 1960-64, 
1964-1969, and 1970-74. The shapes of these curves are somewhat distorted by the fact that the 
data is not stationary, but since the growth rate was shown to be linear, the effect on each should 
be similar. It is interesting to compare these curves with the bathtub curve of classic reliability 
theory. It will be recalled that this curve consists of a period of declining failure rate, a period of 
constant failure rate, and a period of increasing failure rate, representing, in turn “infant mortality”, 
random failure, and wearout. The distribution of failures in the wearout portion is usually con- 
sidered to be Gaussian. 


It will be observed that the 196064 data corresponds in shape to the infant mortality portion of 
the curve, in keeping with the fact that the industry itself was in its infancy. The 1 965-69 data, 
although not as well defined, suggests a broad wear-out penod between two and five years after 
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Figure 2. Distribution of Useful Lifetimes for Three Different Time Periods 
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launch. This corresponds to the typical wearout lives of continuously degradable devices such as 
batteries, tape recorders, solar array drives, scanning devices, etc, during this period, as we'l as 
indicating that spacecraft placed in high-drag orbits were surviving until reentry, which typically 
occurs in this time frame. The outliers in this group are the three communications satellites. Appli- 
cation Technology Satellite (ATS) 1, 3, and 5. Communication satellites typically have longer 
lifetime potential than other types since they have minimal pointing accuracy requirements, limited 
depth of battery discharge, and do not contain tape recorders and other electromechanical devices. 
Although the data suggests that infant mortality was no longer a problem in this time frame, as 
noted earlier three missions failed to achieve the desired three-axis stabilization and on that basis 
it could be said that the infant mortality problem had not been completely solved. 

By the 1970-74 period, component wear-out lives had been broadened and extended to the point 
that they no longer cause a concentration of termination points, and the data takes on the appear- 
ance of the “random failure*’ portion of the bathtub curve. This indicates not that spacecraft were 
failing due to nndom causes, but that the reasons for mission termination had been randomized in 
that they had been expanded to include the management options discussed earlier. 

USEFUL LIFE VS. DESIGN LIFE 

A vety fundamental measure of spacecraft performance may be established by comparing design 
lives with lifetimes actually achieved. To also see if there has been any temporal trend in this 
distribution, the data was divided into the same 5-year intervals used in Figure 2. The results 
are shown in Figures 3, 4, and 5. Points to the left of the diagonal lines correspond to spacecraft 
which failed to meet their design goals. 

Previous investigators of spacecraft lifetime data have concluded that there is no correlation be- 
tween design life and useful life (Reference 1 , 2, 3). By dividing the Goddard data into 5-year 
intervals, however, it is possible to detect certain trends. In the 1960-64 period, for example, 
extension of design lives to one year seem to have been premature, since the majority of nvssions 


9 



IQ 


in 

on 

X 

>■ 



I 


► w 


3 

L. 

id 

in 

ZJ 


r* 

n 


rvi 


; B. 


'3JM N9I530 


:o 


Figure 3. Comparison of Design Life and Achieved Useful Lift: of Spacecraft Launched I960 Through 1964 
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Figure 5. Comparison Between Design Life and Achieved Cseful Life for Spacecraft Launched 1970 Through 1974 


so designated failed to meet the goal, and in terms of median life were actually outperformed by 
the 6-month missions. In the 65-69 period, one-year mission lives were readily achieved with few 
exceptions, although the 6 month missions continued to perform as well as the one-year missions. 
The three-year missions (ATS 1,3,5) clearly outperformed the median lives of the shorter design 
goal spacecraft. In the 1970-74 period, although there is still considerable scatter in the data, a 
proportionality between design life and median useful life was beginning to develop, and continua- 
tion of the usual one-year goal had become a very conservative practice. 

The fact that mission lives have tended to exceed design goals by a wide margin has long been 
recognized, and in the late seventies design goals for Goddard spacecraft began to routinely be 
extended to 2-5 years or more. 

PROGRAM MATURITY AND TYPICAL LIFETIME 

The majority of Goddard spacecraft have not been one-of-a-kind items, but have been members of 
a project series of largely identical spacecraft. 

The most extensive program managed by Goddard has been the TIROS Project, consisting of four 
series of missions encompassing three generations of weather satellites with a total, to date, of 27 
missions. 


In examining lifetime data by series, two things become clear: first, that a "learning curve" often 
takes place over the first few missions, and second that each series seems to have a "normal" or 


“typical" lifespan. The m^jor examples are shown in Table 2 below. 


Table 2 


PROJECT 

NO. OF S/C TO REACH 
TYPICAL LIFESPAN 

TYPICAL LIFESPAN (YRS) 

TIROS 

7 

3-4 

rros 

3 

3-4 

oso 


3-4 

OGO 1 

3* 

3-5 

OAO 

*> 

8-10 

NIMBUS 

4 

8-10 


•Based on OGO I and II being classified as mission failures, despite long lifetimes. 
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The normal lifespan is essentially the wearout life of the mission. Some variability may be expected 
among projects as to what constitutes wearout, however. For example, a science mission returning 
unique data may be viable as long as one key experiment is active, whereas an applications satellite 
might be considered “worn out” at a much higher performance level. 

As a matter of engineering interest, the major reasons for the relatively abbreviated earlier missions 
of each series are discussed below: 

TIROS: The prime instruments on the TIROS missions were a pair of TV cameras, which were 
semi-redundant but had different viewing angles. Considerable difficulties were experienced with 
the shutters, focusing mechanisms, etc. of these cameras, as well as with tape recorders. The first 
six missions lost at least one camera in the first 90 days of flight. 

ITOS: The first two flights of the second-generation TIROS experienced excessive brush wear and 
other problems in the momentum wheel assembly. This problem was solved on the third flight by 
a new design which featured a brushless motor. 

OSO: Both OSO I and II lacked magnetic torquing capability, resulting in excessive use and pre- 
mature depletion of control gas. OSO-I also lost its tape recorders early, and (through no fault of 
its own) was damaged by the “starfish” atmospheric radiation event. 

OGO: OGO contained a number of deployable booms. One OGO-I boom did not fully deploy, 
creating an artificial horizon for the horizon sensor, and causing control gas to be rapidly depleted. 
Thus, three axis stabilization was not achieved, and the spacecraft had to be operated in a spinning 
mode, complicating data reduction. OGO-II’s horizon sensors were sensitive to clouds, limiting 
their effectiveness, and again presenting an attitude control problem. Thermally induced boom 
bending caused attitude control problems on OGO-III as well, but the mission was officially 
successful. 
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OAO: OAO-I suffered a power failure which terminated the mission shortly after launch. A high- 
priority recovery effort was mounted, with the full resources of the Center being applied to the 
resolution of this and other OAO problems. Subsequent missions were brought in-house for inte- 
gration and test, rather than relying on the contractors facilities. The subsequent OAO-II and 
OAO-III missions were highly successful. 

Nimbus: The Nimbus-I solar array drive failed after 26 days. Nimbus II and III both experienced 
ACS scanner failures short of 3 yean in orbit. Having solved these problems. Nimbus IV achieved 
a 10 year useful lifetime, and subsequent Nimbuses appear headed for similar lifetimes. 

Other Programs: Other programs have also shown growth in performance effectiveness over the 
fust two or three launches, although not necessarily in a way which explicitly affected the duration 
of their useful lives. For example AE-C, the first of a three-mission sequence (not directly compa- 
rable to the much earlier AE-A and B missions) experienced a fortuitous situation when one memo- 
ry programmer failed in the “read” mode and the redundant unit in the “write” mode, with little 
consequent effect on the mission. Trouble was also experienced with the S-Band Transponders, 
one of which became unstable with temperature, while the other became difficult to get into the 
high power mode. AE-D failed after about 6 months due to a single-point failure in the power 
system. The third mission, AE-E, on the other hand, was in excellent condition with no loss of 
redundancy or instruments when it reentered after 5 years in orbit on June 10, 1981. 

TRENDS IN PROBABILITY OF SUCCESS 

Growth in the probability of achieving successful operation for various durations ranging from 6 
months to 5 years is shown in the family of curves in Figure 6. The curves are based on a moving 
average of 9 spacecraft, a sample size which was selected to optimize definition on the time axis 
while retaining a reasonable sample size. Note that the probability of achieving a useful lifetime of 
up to three years had reached an essentially stationary value by the late 1 960’s but that the prob- 
ability of achieving even longer lifetimes appeared to be still growing as of 1 975. 
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OPERATIONAL RELIABILITY : 1970-1980 Missions 


J 


Reliability is defined as the probability of achieving successful performance as a function of time. 
To denote that “successful performance” is defined specifically herein by useful lifetime, the 
modified term “operational reliability” will be used. Thus, a non-parametric (that is, independent 
of any assumed distribution) estimate of the operational reliability of the global population of 
spacecraft may be derived by dividing the number of units active at any given time by the number 
present in the original sample. In this case, the entire data base, including active projects, may be 
included in the sample by treating the active satellites as truncated data, that is, as data which ends 
before a conclusive result occurs. The truncation time for each active project was calculated as of 
July 1, 1981. This is dealt with by simply subtracting the truncated sample from both the numera- 
tor and denominator of the equation, yielding the overall expression: 


No-N f -Nt 

n 0 -n t 

Where: R = operational reliability 

Nq = number in original sample 
Np * number “failed” (terminated) 
Ny * number truncated 


( 2 ) 


A historical view of the operational reliability curve at any point in calendar time covering the 
first five years of flight may be derived by taking a vertical slice through the data shown in the 
“probability of success” curve in Figure 6. However, it is of interest here to derive the curve from 
a larger sample, as well as to include the influence of the most recent missions. 


Figure 7 illustrates the composite operational reliability of all Goddard spacecraft in the data 
base launched since 1970, based on equation 2. In addition to active spacecraft, Magsat was treated 
as truncated data on the grounds that it had not degraded between launch and the time it re- 
entered, as Dlanned, six months later. 


RELIABILITY MODELING 

It is useful to derive a mathematical mode! to fit the observed data. This can be done by either a 
direct curve-fitting process or by utilizing the general expression for reliability: 
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R — c JTy^dt (3) 

where h^, the hazard rate, or instantaneous failure rate, is defined as the probability of a failure 
occurring in an interval of time A t as A t approaches zero, given that the item has survived until 
the beginning of the interval. In reliability analysis, the most commoniy used model is one in which 
the hazard rate is assumed to be constant, in which case the reliability expression reduces to: 

R = e"*‘ (4) 

where X is the failure rate. 

The constant hazard rate model implies that the failures are chance occurrences which are inde- 
pendent of time. Hence, one would not expect this to be an appropriate model for spacecraft 
reliability, since many of the elements which limit spacecraft lifetime are clearly time-dependent 
(wearout, obsolescene, completion of mission, etc.) The poor fit of the constant failure rate model 
to the spacecraft data is illustrated in Figure 8. 

Direct calculation of hazard rates is another approach to the development of a model. However, 
using the individual data points in these calculations results in too much scatter to be of value. 

Better results may be obtained by dividing the data into intervals and calculating the average values 
for each interval. Shooman (Reference 4) derives the following formula for determining the correct 
number of intcn als: 

K = 1 + 3.3 log 10 N (5) 

Where K is the optimum number of intervals and N is the number of failures. Since the data has 
25 failure points (terminations), this suggests 5 or 6 intervals. Since the data covers 10 years, it 
is convenient to use five 2-year intervals. Ideally, the data should contain many more samples 

m 

than those which failed, otherwise the sample size becomes too small to have any validity in the 
later intervals. Since this was unavoidable in the present case, which has only three data points in 
the last four years, the final two intervals were excluded, yielding the following result: 
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Figure 8. Constant Failure Rate Model 




Interval 

Mid-point 


0-2 years 

1 year 

0.06 

2-4 years 

3 years 

0.19 

4-6 years 

5 years 

0.27 


Hence, the data shows an unquestionably increasing hazard rate, which is also virtually linear. 
Although it is obviously a questionable practice to fit a curve to only three data points, this illu- 
strates both the method and the problems associated with using the hazard rate method. In this 
particular case, the best fit curve is the linear function: 

h( t) ^ 0.021 +0.05 It (6) 

Applying this to the generalized reliability equation (Equation 2) yields the model: 

R = exp -[0.021 t + 0.026t 2 ] (7) 

This curve is compared with empirical data in Figure 9. The fit is rather good, considering the 
uncertainty in the hazard rate function. 

The most frequently used function in reliability modelling is the Weibull distribution, which is 
very flexible in its ability to fit many different curve shapes. In the simplified form applicable to 
reliability the equation is: 

R = exp -|“j (8) 

Where “b” and “a” are called the shape and scale parameters, respectively. A third parameter 
in the general Weibull expression called the location parameter is not required since R always 
equals one at t * o. The Weibull fit to the present data yields the following expression: 

* ftl 1 - 9 

R*exp-I~j (9) 

The resultant fit is shown in Figure 10. The hazard rate implied by this function is: 

h (t) * 0.3 ''t 09 
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USEFUL LIFE/ YERRS 



Which is an increasing rate having a slightly decreasing sl;» -j. The slope change is virtually imper- 
ceptible over the period covered by the empirical data. 

OPERATIONAL RELIABILITY OVER THE FIRST THREE YEARS OF FLIGHT 
As illustrated in Figure 6, the probability of success, or operational reliability, h * reached an 
essentially stationary value for at least the first thre years of flight by 1970. Moreover, there is 
more homogeneity in spacecraft longevity data during the early portion of life, since some of the 
reasons that influence the decision to terminate a spacecraft in later periods, such as replacement 
or obsolescence, are not present. Also, the earlier stages of flight are obviously the most important, 
particularly the period encompassed by the design life, in evaluating the success of the program. 
Thus, it is of interest to investigate this period in more detail. 

Figure 1 1 shows an expanded view of operational reliability for the first 3 years of flight with the 
specific mission terminations noted. 

For the purpose^ of this report, the useful lifetime of SMM is considered to have terminated in 
December 1980, due to the loss of fine pointing control, although this is not necessarily an official 
viewpoint, and 2 of the 7 instruments an: still receiving good data. 

The reasons for termination of the missions with less than 3-yeai lifetimes are described and catego- 
rized below: 

LESS THAN I YEAR 


SPACECRAFT 

PRIMARY FAUuT 

PROBLEM CATEGORY 

SAS-B 

Instrument Lost Power 

Design 

AED 

S/C Lost Power 

Design /Workmanship 

SMM 

Lost Fine Pointing Control 

Design 

ITOS-A 

Momentum Wheel Failed 

Design 



COMPOSITE RELIABILITY: I97B-I9BB 



25 


Figure 1 1 . Operational Reliability Over the First Three Years of Flight for 43 Spacecraft Launched 
1 970 Through 1 980 With Specific Terminations Noted 


1-2 YRS (Exceeded Design Life) 


TIROS-M 

Momentum Wheel Degraded 

Design 

2-3 YRS (Exceeded Design Life) 

HCMM 

Battery Degraded 

Design/Quality 

ITOS-D, F, H 
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Unknown 
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Two of these missions, SSS and AEM-A (HCMM). were “low-cost” missions lacking box-level 
redundancy. SSS essentially completed its mission, and although the battery had failed as expected 
after slightly less than 1 year in orbit and the loss of the analog multiplexer (possibly due to a MOS 
damaged by radiation) after about a year and a half had caused some loss of analog data, the termi- 
nation point just prior to three years was arbitrary and there would be substantial justification for 
treating this spacecraft as truncated data. HCMM experienced battery shorts attributed to cadmium 
migratation, and required a superior effort in ground control to maintain it in active service after 
the first few months. Six of the others were missions of the TIROS Project, whose lives were 
limited primarily by wearout of mechanical devices, especially in the instruments. 

Excluding the low-cost and TIROS/ITOS missions, only three missions failed to perform all mission- 
critical functions for at least three years, and each of these failed due to design problems occurring 
between 6 months and 1 year of flight. Further, all spacecraft which failed to achieve at least two 
years of useful life were the first or second of a series. 

Evaluation of the foregoing must be tempered by the fact that an additional number of missions 

have been troubled by anomalies which threatened to curtail or very severely degrade their mission. 

% 

although these problems did not necessarily shorten the useful lives of the spacecraft. A total of 
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nine such missions have been identified among the 1970-1980 flights, including one launch vehicle 
problem, of which only two are also included in the “less than three year life" category. Since this 
constitutes 20 percent of the total sample, it is important to keep this in mind in evaluating space- 
craft reliability. The missions and specific problems they encountered are described in Appendix C. 

OTHER STUDIES 

"xtensive related studies were conducted during the mid-seventies by Rand, TRW. Aerospace 
Corporation and possibly others. The findings of these studies, which were not limited to Goddard 
or NASA projects, are of general interest. 

The Rand study (Ref. 1) was aimed at aiding the Air Force in determining procurement strategics 
for long-term missions. The report states "At the start of the study we felt that there should be a 
number of instinctively plausible relations between various spacecraft parameters and spacecraft 
reliability ... No truly significant correlations were found . . .” 

The attempted correlations were between achieved lifetime and design life, program costs, and 
percentage of program costs allocated to reliability. No attempt was made to normalize the data or 
investigate the parameters discussed herein. The major positive finding seemed to be that reli- 
ability models built up from empirical component failure rate data should be less pessimistic and 
therefore more accurate than those built up from exponential piece-part failure rates. 

The referenced TRW report (Reference 2) was one oi a series representing a long term effort by 
TRW to understand and improve reliability modelling techniques. TRW found that there are good 
program', and problem programs, with reliability modelling having generally been very pessimistic 
in forecasting operational reliability overall, but systematically optimistic in predicting the reli- 
ability of problem programs. The author believed but had not proven a correlation between pro- 
gram funding problems (overruns, etc.) and the likelihood of the program becoming a problem 
program. Oddly, a review of the TRW data shows that the problem programs tended to be those 
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with the longest assigned design iives, resulting in a negative correlation between design life and 
achieved life. 

Ten TRW spacecraft, or 24% of those launched, had catastrophic or near-catastrophic design failures 
(not necessarily within the design life), all but one of which were single-point failures. TRW did 
note a positive effect from program maturity, but this apparently manifested itself as a lower inci- 
dence of failures in components rather than in longer achieved lifetimes. By contrast, the Goddard 
data shows no generic problems in mission series that did not yield to design improvement in 
subsequent missions. 

The Aerospace study (Ref. 3) wa3 aimed primarily at program management strategy for cost reduc- 
tion, and was performed for NASA Headquarters. It included data from seven Goddard spacecraft 
in its data base. A feature of this study was an ambitious attempt to quantify mission complexity 
by assigning weights to 20 different parameters. The study evaluated various parameters against 
“program success” (not reliability) defined as a combination of cost and schedule control and 
mission performance factors. Mission performance was based entirely on anomalies occurring 
during the first 30 days of flight. The rationale for this performance criterion was that the major 
design defects would probably appear within this interval. In evaluating their results, it should be 
noted that the Goddard data shows that since 1970 the most damaging defects have taken six 
months to one year to manifest themselves. 

Under the ground rules of the study, it was concluded that neither program cost nor complexity 
are correlated with mission success. On the other hand, freedom from hardware defects correlated 
well with the percentage of program cost spent on production quality assurance (but not for devel- 
opment quality assurance although the data ?eemr insufficient in this regard), and very strongly 
with test program thoroughness in general and flight acceptance testing in particular. 

The data is presented graphically, with the project name noted at each data point. It is interesting 
to note that the NASA programs, most of which were Goddard projects, were clearly superior in 
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this regard, having consistently had more thorough test programs and correspondingly fewer flight 
defects. Further, Goddard’s Q.A. programs were consistently less costly while at the same time 
more effective than others ! \ the study. 

The Rand study reported operational reliability data, which was fitted to a Weibull distribution, 
and quoted the TRW data, similarly fitted. The reported best-fit curves were: 

r t 10511 r t 10,859 

TRW: R »exp-|— I ; Rand: R = eXp [ 232 J 

Where t is in months. 

The resultant reliability at 1,2, and 3 years, as compared with the Goddard data, is as follows: 

RELIABILITY ESTIMATE 

> 

I 


TIME 

RAND 

TRW 

GSFC 

1 YR 

.924 

.882 

.956 

2 YR 

.867 

.790 

.869 

3 YR 

.817 

.710 

.752 


The Rand study included twenty- two Goddard spacecraft in a total of 73 missions. The TRW 
study included the six OGO missions in a total of 42 missions. The Aerospace study contained 
only 14 spacecraft, of which 7 were Goddard missions. 

DISCUSSION 

The general findings of the study are: 

. Median spacecraft useful lifetime grew at the persistent and essentially linear rate of about a 
third of a year per year through at least 1974. More recent data is indeterminant since the majonty 
of more recent missions are still active, but the 1975 median has already reached the predicted 
value, and there is no reason to believe that the trend is not continuing. If so, the median lifetime 
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of spacecraft launched today wou/d be about lVi years. The normal wearout lifetime of many 
configurations might reasonably be expected to be considerably longer. In the future, however, 
composite data may become less meaningful as greater correlation between design life and useful 
life is attained, and missions become increasingly tailored to specific lifetime goals. 

2. By 1 970, operational reliability had become an essentially stationary function over the first 
three years of flight, although longer-term reliability was still growing as of at least 1975. The four 
missions of the 1970-1980 composite sample of 42 spacecraft (excluding Magsat) which failed to 
survive the first year in orbit were scattered through the decade, further substantiating the assump- 
tion that no further improvement is imminent. The failures in each case were attributable to 
systematic (rather than random) causes linked to design weaknesses. In addition, about 20% of all 
spacecraft experienced launch phase c 'arly orbit anomalies which threatened to curtail or seri- 
ously degrade the mission. The majority of these difficulties were also attributable to systematic 
causes. 

3. Each project seems to have a normal lifetime which is not correlated with its design life except 
in the sense that it exceeds it by a wide margin, and in the sense that by the early 1970’s the be- 
ginning of a trend toward missions with longer design goals achieving longer median useful life- 
times could be observed. The normal lifetime of a mission seems to be a function of the particular 
configuration employed, which determines the wearout life of the critical components, and the 
termination criteria applied to the specific mission. Often this normal lifetime is either not achieved 
until the third spacecraft of a series, or lower-quality performance is tolerated on the earlier 
missions. 

4. By inference, then, random failures seem to have played a relatively minor rok in establishing 
useful lifetimes, although they undoubtedly have made an indeterminate contribution to the de- 
gradation which is often a key factor in the decision to terminate a mission. A probable reason for 
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the relatively minor impact of random failures is that processes such as quality assurance, testing, 
and especially the use of redundancy are more effective against these defects than they are against 
design problems. 

5. Although not specifically investigated in the current study, the findings of the referenced re- 
lated studies to the effect that no correlation has been found between mission cost and complexity 
is qualitatively corroborated by this study in that the missions which had relatively short lives do 
not fit any particular pattern in this regard. They range from the highly sophisticated SMM space- 
craft to the low-cost SSS and HCMM programs. On reflection, it might be said that this lack of 
correlation is, in a sense, almost an Agency goal. Low cost missions for example are invariably 
less complex, and are much more likely to be designated “high risk” than others. Thus, it should 
not be surprising that the higher risk assumed on these missions is counterbalanced by the greater 
complexity of the higher cost missions in terms of the probability of early failure. Although not 
explicitly explored in this report, there does seem to be a gross correlation between normal life- 
time and cost/complexity level, possibly because redundancy, for example, while not a good de- 
fense against design problems, does tend to extend wearout lives by providing a backup for the 
tailed unit. There is some question as to whether finer-grained correlations are feasible because of 
the difficulty of quantifying complexity and acquiring cost data which is directly comparable on a 
mission-tomission basis. 

The agreement in the early life reliability calculations between the Goddard data and the broader- 
based TRW and Rand data is close enough that no statistical significance may be inferred regard- 
ing the differences. It is noted however, that the Rand and TRW Weibull models h call for an 
exponent (shape factor) of less chan one, which corresponds to a declining hazard rate. (A shape 
factor of one corresponds to a constant failure rate). Although in-orbit anomaly studies at Goddard 
and elsewhere have shown that failure rates of components tend to decline as a function of time, it 
does not follow that spacecraft failure rates should also decline. They depend, in part, on the 
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cumulative effect of component failures, which can only increase with time regardless of the shape 
of the component failure rate curve. Since the other factors contributing to spacecraft termination 
are also increasing functions of time (obsolescence, replacement, withdrawal of funding, etc), it is 
difficult to envision, a scenario in which a decreasing hazard rate would be appropriate. The God- 
dard data clearly shows an increasing hazard rate, as might reasonably be expected. 

In any case, the models are not considered directly applicable to predicting the reliability of any 
arbitrary future snacecraft, which might better be done by making allowance for the position of 
the spacecraft in its series, and estimating the normal lifetime of the series either by direct compari- 
son with similar series or by generalizing from extrapolated life data. The primary value of the 
model is to allow quantitative comparison with future data as a means to evaluate progress. 

The study clearly shows that the most fruitful path to improved reliability lies in reducing the 
probability of unexpected design problems. It is by no means clear, however, how this might be 
accomplished. The independent design review function in use at Goddard effectively brings to bear 
the cumulative experience of Center experts on each spacecraft, and is informally credited with 
averting many potential difficulties. Suggestions such as better end-to-end testing and more realis- 
tic test parameters seem facile in that they beg the question of how these goals are to be achieved, 
let alone in a cost-effective manner. A complicating element is the fact that the catastrophic 
failures in Goddard spacecraft have taken 6 months or more to materialize, and hence would have 
required unpractically long life tests, or life tests accelerated in some indeterminate fashion, to 
accomplish. 

More imaginative approaches were proposed by Barnett (ref 2), but they seem impractical. One 
was to consider design redundancy, oy which is meant the concurrent use of redundant components 
of differe t design developed by different groups. The other was to expand the FMEA procedure 
to include questioning the design itself (i.e., what if this design just plain does not work), a proce- 
dure which seems too open-ended to be "do-able”. 
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l'he advent of Shuttle provides an interesting situation which in a sense may render the question 
moot. If the first Shuttle flight of a given project is considered the ultimate life test, and design 
problems continue to be solvable for subsequent missions, the problem will in effect be solved at 
a cost which is the cost of retrieval and refurbishment multiplied by the fraction of spacecraft 
which experience these problems. 

It need hardly be said that the emphasis on design and systematic failure throughout this report 
should in no way be construed to imply that the flight assurance activities in force at Goddard are 
either entirely efficient and cost-effective at eliminating random defects on the one hand or that 
such defects are trivial on the other. The growth in spacecraft reliability has been achieved in part 
by technological advances in the design of aerospace equipment for longer lifetimes, and in part in 
spite of the increasing complexity and constant need to deal with unproven hardware brought 
about by these same advances. These developments present a constant challenge to develop in- 
creasingly perceptive screening techniques simply to maintain equivalent failure rates. 

It should also be clear that operational reliability is only a partial measure of total performance, 
which also involves the quality and quantity of scientific data produced during the life of the 
mission. This in turn is affected at least subtly by ail but the most trivial anomalies, whether ran- 
dom or systematic. Substantial further study is needed to develop models which incorporate all 
aspects of mission performance in a unified expression, and to measure the effectiveness and im- 
po>. tance of all phases of the flight assurance program. 
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Launch Vehicle Performance 

The following Goddard Missions were unsuccessful due to launch vehicle failure: 


Mission 

Launch Date 

Launch Vehicle 

ECHO V 

5/13/60 

DELTA 

PIONEER P-30 

9/25/60 

ATLAS ABLE 

PIONEER P-3 1 

12/15/60 

ATLAS ABLE 

BEACON A (S-66) 

3/19/64 

DELTA 

IMP-B 

10/4/64 

DELTA 

OSO-C (S-57) 

8/25/65 

DELTA 

ATS-II 

4/6/67 

ATLAS AGENA 

NIMBUS-B 

5/18/68 

THORAD AGENDA D 

ATS-IV 

8/10/68 

ATLAS CENTAUR 

OAO-B 

11/30/70 

ATLAS CENTAUR 

ITOS-B 

10/21/71 

DELTA 

rros-E 

7/16/73 

DELTA 

NOAA-B 

5/29/81 

ATLAS-F 

Recent reliability figures for the most frequently used NASA launch vehicles are: 


LAST 10 LAUNCHES 

LAST 20 LAUNCHES 

SCOUT 

0.90 

0.95 

DELTA 

1.00 

1.00 

CENTAUR 

1.00 

0.95 
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SERIOUS EARLY ORBIT ANOMALIES 

SSS: This spacecraft had 2 long and 2 short booms. Active nutation damping had been considered, 
but was deemed unnecessary. After orbital injection, a high nutation rate was observed. It was felt 
that this was produced by tipoff, and would soon damp out. Instead, the nutation angle continued 
to increase, threatening to put the spacecraft in a tumbling mode. 

At this point, an ingenious plan was devised to utilize the magnetic attitude coil in an unplanned 
mode to introduce damping. This required reprogramming the on-board computer to pulse the 
coils. The technique worked and the mission was saved. The problem was attributed to thermal 
distortion of the booms which induced oscillations and changed the system’s mass properties. The 
lesson learned was subsequently applied to the 750 foot booms utilized on the RAE missions, 
which were perforated to allow more even solar heating. 

ATS-6: Less than a month after launch, a partial failure in the roll wheel drive circuitry caused the 
ACS to become unstable in roll, forcing ATSOCC operations personnel to switch from wheel 
control to jet control. However, the prospect of using jet propellent full time for the remainder 
of the mission threatened to significantly shorten the useful life of the spacecraft. Due to the 
flexibility of the programmable Digital Operational Controller (DOC), ACS engineers were able 
tc reprogram the DOC into a “mixed mode" of operation whereby the pitch and yaw axes operated 
on wheels and the roll axis utilized jets, thus conserving control gas. 

AE-C: Two weeks after launch, one of two redundant memory programmers failed in the “write" 
mode due to a stuck bit. At day 297, the redundant memory also had a failure due to a stuck 

bit but in the “write" mode. Thus the mission continued due to the fortunate way in which 

these failures combined. 

OSO-7 : When OSO-7 was launched, the second stage of the Delta rocket failed to place the space- 
craft in the nominal orbit. The spacecraft was sent tumbling and the orbit was approximately 350 
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kilometers by 5 70 kilometers, rather than the nominal 556 kilometer circular orbit. Aftei spinup, it 
was found that the pitch angle exceeded 70 degrees, v/hereas it should have been near zero. On orbit 6, 
the project personnel succeeded in achieving normal pitch lock, and the spacecraft was saved. Al- 
though the anomaly occurred in the launch vehicle, it was operational flexibity that saved the mission. 

OSO-8: Shortly after launch, the two primary (pointed) instruments both degraded one to two 
orders of magnitude due to contamination Apparently sensitivity was sufficient that good data 
was received despite this handicap. 

SAGE: Utilizing the same base module as HCMM, this spacecraft has had the same battery degra- 
dation problem, and is operating on a reduced data acquisition schedule. 

TIROS-N : An unexpected torque disturbance began in revolution 4 which persisted for about 84 
minutes and imparted 938 in-lb-sec of angular momentum. On-board reaction wheels were unable 
to handle the rapid build-up of angular momentum, and the spacecraft went into a tumbling mode. 
Following uplink modifications to flight software, GNi was reactivated on rev. 12 to remove the 
body rates so that reacquisition and earth lock could be accomplished using the wheels. The cause 
was attributed to B-nut relaxations due to pyro shock which caused NjN 4 to leak. 

NOAA-A: A disturbance of unknown origin occurred during the first orbit after handover, causing 
a large attitude perturbation on the spacecraft. The spacecraft’s attitude control system functioned 
properly throughout the event and attitude control was restored within 15 minutes. The most 
probable cause was failure of the Rocket Engine Assembly-3 thruster valve caused by pressure 
buildup from heat soakback, thus allowing the hydrazine to leak through the valve to the catalyst 
bed, producing a torque on the spacecraft. 

Magsat: During the launch phase, one of two redundant sub’imation timers failed to operate, and 
the other operated 4 minutes late. Also, the scalar magnetometer, needed to calibrate the vector 
magnetometer, had a noise problem such that it produced only 20-30% good data. However, only 
about 15% good data was needed to meet scientific objectives. 



